Voting
In-person binding votes are cast on a paired kiosk. A kiosk can be any device the organization pairs with a device approval passcode. Turnout can show who voted, not how they voted.
Non-binding voting can be done from any device, so members can vote from their own phone or computer.
Secret ballot
Choices are saved without the member's name. Staff can see who voted. The results show how the choices added up.
1
A member can vote only when they are on this organization and in a member group the vote includes. If no group is selected, nobody can vote.
2
The organization can require a one-time passcode, a claimed member login, or either one. A passcode is marked used when a voting session starts. A login has to be a claimed membership for that organization.
3
Each member can have one accepted ballot. If they have already voted, they cannot cast another. They also cannot open a second session while the first one is still active.
4
Starting a ballot creates a short-lived session. That session is stored as a hash, and it is deleted when the ballot is accepted. The receipt keeps the member and the time they voted. It does not keep their choices.
5
Accepted choices wait with other ballots. They are shuffled into a batch when enough ballots are waiting, or when the hold time is reached. Staff can also send waiting ballots through when they close the vote. Counting adds up those choices. It does not look up a member.
6
Each saved choice is also written to a log with the batch, the question, and the option. That log does not name the member, the user, or the ballot. Results are counted from the ballots, not from the log.
7
A turnout export lists who voted. A ballot export lists the choices and does not list the member. Results are limited to people who can manage the organization.
8
In-person binding votes are cast on a paired kiosk. Pairing checks a device approval passcode, which is stored as a hash. A paired device can be revoked. Non-binding votes can be cast from any device.
9
Ballots are accepted only while the vote is open, and only inside the open and close times when those times are set.
10
Once a voting session has been issued, who can vote and how they sign in stay locked. Once a ballot is accepted, the questions stay locked.